Hi Dash Commuity.
I have been working with @strophy on possibly upgrading the Dash Masternode setup guide to make the installation of Dash more inline with other packages, ie a proper installation of Dash in system wide directory /opt. The advantage of doing so, means the dashd daemon can then be controlled by systemd and made to start at boot and restart in event of a crash, it makes upgrading easy, it means the executables are managed by root alone, it makes downgrading easier, it means there wont be other rouge versions of `dashd` floating around that confuse users.
@strophy has asked me to post this and Request For Comments from community members, eg @UdjinM6 and others I don't know you all. Also, thanks to @t0dd for the dashd.service unit file, which I pinched and tweaked and stripped.
The flow is similar to what you might find in the LinuxFromScratch book, which basically explains the commands and their purpose and then provides a block the user need only copy and paste into the terminal. Where possible the blocks are fault tolerant and re-runnable. Also, for crucial blocks they will echo a confirmation message for peace of mind, and help with support.
The installation attempts abide my the principle of least privilege as that will increase the security of the server. It prevents ssh logins via root, you need only check your VPS logs to see how often that is brute forced on your machine, rather it creates two new users dashadmin and dash the admin user will have sudo privelges, but the dash user no special priveleges whatsoever and password that is pure random.
The part of the existing guide https://docs.dash.org/en/stable/masternodes/setup.html#set-up-your-operating-system that I want to change starts from the VPS setup. Ie right from the first login to the freely created VPS. I have tested the guide in Ubuntu 18.04 LTS and Raspbian (Rasp Pi2b). It is fully portable.
Below starts the new stuff. Oh note, the commentry is very terse at the moment, but the code is correct, requesting comments on the code/strategy.
# This is the updated guide for MN setup.
# Login to the VPS as root and change the password of this user to something complicated and long, write it down and keep it safe.
# We will create two new users, one to administer the server and one to run the `dashd` service. We abide my the principle of least privilege `https://en.wikipedia.org/wiki/Principle_of_least_privilege` as that will increase the security of the server.
# For the dash user, choose a very random long passwd. You don't have to remember this password or write it down, it will never be used.
# For the dashadmin user, choose a long password and write it down, this is the password you will use from now on to login into the VPS and administer the masternode.
# Now it is time to logout and try logging in with your dashadmin user and password. To logout, press CTRL+D in the PuTTY (shell) window, or type exit, or type logout until the window is closed, avoid pressing the X icon to close this window.
# Login as dashadmin
# Make sure you are now logged in as dashadmin and not root, check with the output from the below command.
# For security reasons we want to disable remote logins to the root user from now on. This user exists on every UNIX/Linux machine and is being brute force attacked on your machine all the time! Run the below block. Copy & paste the block in one go into the terminal (PuTTY).
# Now, we will update the system from the Ubuntu package repository:
# Install additional packages required for the MN.
# Configure a firewall.
# Configure swap space so that the VPS has at least 1GB of swap, this helps with avoiding crashes when the RAM is running low.
# Memory management. We want the VM to use memory more effectively and prevent crashes due to low memory. Run the below to set this parameter.
# Time now to let the above changes take effect and make sure the VPS is able to reboot properly. Run the below command to reboot the VPS, your terminal session will automatically close.
# Log back into the VPS using dashadmin.
# Make sure you are now logged in as dashadmin and not root, check with the output from the below command.
# We now download and install the dashcore software. Run the below commands.
# Generate the SHA256 hash (checksum) for the package to make sure it is not corrupted or been tampered with in some way, do not skip this step.
Verify the hash matches the one from the github page https://github.com/dashpay/dash/releases click on the latest version and find the file called SHA256SUMS.asc and open it ina text editor. You can also verify the signatures with the core devs using Darren TAPPs guide
, but for now I am not adding those steps here.
# If all the above checks are OK, the proceed the install the package copy & paste the block below to install Dash.
# Note: When upgrading to a version that is 0.16.x where x is 1,2,3... use the above command and change the version number as appropriate, you will also have to download and check the file hash as posted above, then stop and start your dashd again (instructions for this are later in this document) and you are done. Watch the wallet though as you may have to restart the MN from the wallet too.
# The dash package comes with user manuals, we want these to be available to the dash user, run the below command.
# Next, we need to configure the PATH environment variable for the dash user so it can run dash commands, eg `dashd` and `dash-cli` etc
# Configure a bare bones dash.conf file.
# Edit the `dash.conf` file with nano and enter your masternodeblsprivkey, Ctrl + X to close the editor, then Y and Enter save the file.
# Next we wish to register the `dashd` deamon as a system process so that is starts automatically when the VPS boots and shutdown automatically when the VPS shutsdown, it will also restart the process if it should crash for some reason.
I have been working with @strophy on possibly upgrading the Dash Masternode setup guide to make the installation of Dash more inline with other packages, ie a proper installation of Dash in system wide directory /opt. The advantage of doing so, means the dashd daemon can then be controlled by systemd and made to start at boot and restart in event of a crash, it makes upgrading easy, it means the executables are managed by root alone, it makes downgrading easier, it means there wont be other rouge versions of `dashd` floating around that confuse users.
@strophy has asked me to post this and Request For Comments from community members, eg @UdjinM6 and others I don't know you all. Also, thanks to @t0dd for the dashd.service unit file, which I pinched and tweaked and stripped.
The flow is similar to what you might find in the LinuxFromScratch book, which basically explains the commands and their purpose and then provides a block the user need only copy and paste into the terminal. Where possible the blocks are fault tolerant and re-runnable. Also, for crucial blocks they will echo a confirmation message for peace of mind, and help with support.
The installation attempts abide my the principle of least privilege as that will increase the security of the server. It prevents ssh logins via root, you need only check your VPS logs to see how often that is brute forced on your machine, rather it creates two new users dashadmin and dash the admin user will have sudo privelges, but the dash user no special priveleges whatsoever and password that is pure random.
The part of the existing guide https://docs.dash.org/en/stable/masternodes/setup.html#set-up-your-operating-system that I want to change starts from the VPS setup. Ie right from the first login to the freely created VPS. I have tested the guide in Ubuntu 18.04 LTS and Raspbian (Rasp Pi2b). It is fully portable.
Below starts the new stuff. Oh note, the commentry is very terse at the moment, but the code is correct, requesting comments on the code/strategy.
# This is the updated guide for MN setup.
# Login to the VPS as root and change the password of this user to something complicated and long, write it down and keep it safe.
Code:
passwd root# We will create two new users, one to administer the server and one to run the `dashd` service. We abide my the principle of least privilege `https://en.wikipedia.org/wiki/Principle_of_least_privilege` as that will increase the security of the server.
Code:
useradd -m -c dash dash -s /bin/bash
useradd -m -c "Dash Admin" dashadmin -s /bin/bash -G sudo,dash# For the dash user, choose a very random long passwd. You don't have to remember this password or write it down, it will never be used.
Code:
< /dev/urandom tr -dc A-Za-z0-9 | head -c${1:-32};echo
passwd dash# For the dashadmin user, choose a long password and write it down, this is the password you will use from now on to login into the VPS and administer the masternode.
Code:
passwd dashadmin# Now it is time to logout and try logging in with your dashadmin user and password. To logout, press CTRL+D in the PuTTY (shell) window, or type exit, or type logout until the window is closed, avoid pressing the X icon to close this window.
# Login as dashadmin
# Make sure you are now logged in as dashadmin and not root, check with the output from the below command.
Code:
whoami# For security reasons we want to disable remote logins to the root user from now on. This user exists on every UNIX/Linux machine and is being brute force attacked on your machine all the time! Run the below block. Copy & paste the block in one go into the terminal (PuTTY).
Code:
if (( $(id -u) != 0 )); then
sudo bash -c \
"grep -q \".*PermitRootLogin [ny][oe].*\" /etc/ssh/sshd_config &&\
sed -i 's/.*PermitRootLogin [ny][oe].*/PermitRootLogin no/g' /etc/ssh/sshd_config||\
echo \"PermitRootLogin no\">>/etc/ssh/sshd_config"
else echo "Only run this block as your dashadmin user, not root."; fi# Now, we will update the system from the Ubuntu package repository:
Code:
sudo apt update
sudo apt upgrade# Install additional packages required for the MN.
Code:
sudo apt install ufw python virtualenv git unzip pv speedtest-cli# Configure a firewall.
Code:
sudo ufw allow ssh/tcp &&\
sudo ufw limit ssh/tcp &&\
sudo ufw allow 9999/tcp &&\
sudo ufw logging on &&\
sudo ufw enable# Configure swap space so that the VPS has at least 1GB of swap, this helps with avoiding crashes when the RAM is running low.
Code:
if (( $(free -m|grep Swap|awk '{print $2}') < 2048 ))
then
echo "Adding 2GB swap..."
sudo bash -c "fallocate -l 2G /var/swapfile&&\
chmod 600 /var/swapfile&&\
mkswap /var/swapfile&&\
swapon /var/swapfile&&\
grep -q \"^/var/swapfile.none.swap.sw.0.0\" /etc/fstab ||\
echo -e \"/var/swapfile\tnone\tswap\tsw\t0\t0\" >>/etc/fstab"
else
echo "You already have enough swap space."
fi# Memory management. We want the VM to use memory more effectively and prevent crashes due to low memory. Run the below to set this parameter.
Code:
sudo bash -c "echo \"vm.overcommit_memory=1\">>/etc/sysctl.conf"# Time now to let the above changes take effect and make sure the VPS is able to reboot properly. Run the below command to reboot the VPS, your terminal session will automatically close.
Code:
sudo reboot# Log back into the VPS using dashadmin.
# Make sure you are now logged in as dashadmin and not root, check with the output from the below command.
Code:
whoami# We now download and install the dashcore software. Run the below commands.
Code:
cd /tmp/
wget https://github.com/dashpay/dash/releases/download/v0.17.0.3/dashcore-0.17.0.3-x86_64-linux-gnu.tar.gz# Generate the SHA256 hash (checksum) for the package to make sure it is not corrupted or been tampered with in some way, do not skip this step.
Code:
sha256sum dashcore-0.17.0.3-x86_64-linux-gnu.tar.gzVerify the hash matches the one from the github page https://github.com/dashpay/dash/releases click on the latest version and find the file called SHA256SUMS.asc and open it ina text editor. You can also verify the signatures with the core devs using Darren TAPPs guide
# If all the above checks are OK, the proceed the install the package copy & paste the block below to install Dash.
Code:
sudo bash -c "cd /opt&& rm -f dash 2>/dev/null;tar xvf /tmp/dashcore-0.17.0.3-x86_64-linux-gnu.tar.gz&& ln -s dashcore-0.17.0 dash"# Note: When upgrading to a version that is 0.16.x where x is 1,2,3... use the above command and change the version number as appropriate, you will also have to download and check the file hash as posted above, then stop and start your dashd again (instructions for this are later in this document) and you are done. Watch the wallet though as you may have to restart the MN from the wallet too.
# The dash package comes with user manuals, we want these to be available to the dash user, run the below command.
Code:
sudo bash -c "echo -e \"MANPATH_MAP\t/opt/dash/bin\t\t/opt/dash/share/man\">>/etc/manpath.config"# Next, we need to configure the PATH environment variable for the dash user so it can run dash commands, eg `dashd` and `dash-cli` etc
Code:
sudo bash -c "echo 'PATH=/opt/dash/bin:\$PATH'>>/home/dash/.profile"# Configure a bare bones dash.conf file.
Code:
sudo -u dash bash -c "mkdir -p /home/dash/.dashcore&&cat >/home/dash/.dashcore/dash.conf<<\"EOF\"
#----
rpcuser=rpcuser$(< /dev/urandom tr -dc A-Za-z0-9 | head -c20;echo)
rpcpassword=rpcpassword$(< /dev/urandom tr -dc A-Za-z0-9 | head -c20;echo)
rpcallowip=127.0.0.1
#----
listen=1
server=1
daemon=1
#----
masternodeblsprivkey=XXXXXXXXXXXXXXXXXXXXXX
externalip=$(curl http://ipecho.net/plain)
#----
EOF"# Edit the `dash.conf` file with nano and enter your masternodeblsprivkey, Ctrl + X to close the editor, then Y and Enter save the file.
Code:
sudo -i -u dash bash -c "nano ~/.dashcore/dash.conf"# Next we wish to register the `dashd` deamon as a system process so that is starts automatically when the VPS boots and shutdown automatically when the VPS shutsdown, it will also restart the process if it should crash for some reason.
Code:
sudo mkdir -p /etc/systemd/system&&\
sudo bash -c "cat >/etc/systemd/system/dashd.service<<\"EOF\"
[Unit]
Description=Dash Core Daemon
After=syslog.target network-online.target
# Notes:
#
# Watch the daemon service actions in the syslog journal with:
# sudo journalctl -u dashd.service -f
[Service]
Type=forking
User=dash
Group=dash
# Make dashd less likely to be killed when RAM is low.
OOMScoreAdjust=-1000
ExecStart=/opt/dash/bin/dashd -pid=/home/dash/.dashcore/dashd.pid
# Time that systemd gives a process to start before shooting it in the head
TimeoutStartSec=10m
# If ExecStop is not set, systemd sends a SIGTERM, which is \"okay\", just not ideal
ExecStop=/opt/dash/bin/dash-cli stop
# Time that systemd gives a process to stop before shooting it in the head
TimeoutStopSec=120
Restart=on-failure
# If something triggers an auto-restart, let's wait a bit before taking further action
# Note: This value is in addition to the stop sleep time
RestartSec=120
# In this interval span of time, we allow systemd to start dashd "burst" number
# of times. With Dash we really only want one instance started, so... let's
# really limit this. But we want to give systemd some room to attempt to
# correct things. To be honest, I think the way things are configured between
# these settings and TimeoutStartSec, only one instance will be initiated.
StartLimitInterval=300
StartLimitBurst=3
[Install]
WantedBy=multi-user.target
# Really useful:
# * https://www.digitalocean.com/community/tutorials/understanding-systemd-units-and-unit-files
# * https://www.freedesktop.org/software/systemd/man/systemd.service.html
# * man systemd, man systemd.service, and man systemd.unit
EOF"
Last edited:
